View Single Post
  #6  
Old 04-11-2004, 16:32
archphase
 
Posts: n/a
if you set the BaseOfCode field w/ yielding alignment to the Memory Alignment that adheres to AddrOfEntrypoint field then you wont get that message.

so like..you get this message typically w/ Packed/Protected files or viriis...anyways heres example:

3 sections:
.text
.data
.foo

So if the file was assemblded normally the entrypoint would be in .text like 1000h or something and baseofcode would prolly by rva of 1000h so if .foo is at rva 4000h just set baseofcode to that and then keep the ep of .foo like what it might be like 4028h...anyways PE loader dont give rats ass about BaseOfCode field..ive never seen it in use atleast.
Reply With Quote